That is already the case in enterprise projects for many years now. Since around 2010, that in most projects I am involved, the CI/CD pipelines can only talk t

That is already the case in enterprise projects for many years now. Since around 2010, that in most projects I am involved, the CI/CD pipelines can only talk to internal repos with vetted dependencies. You can still do whatever locally, however the build will break when using non authorised dependencies.